[RFC v5 07/28] hw/arm/smmuv3: Reject secure STEs with stage-2 enabled

Pass sec_sid into decode_ste() and treat a secure STE that enables stage-2
translation as an illegal STE.

The current model does not implement Secure stage-2 translation, so reject
Secure STE configurations that enable stage 2 and report BAD_STE. This
restriction can be relaxed when SEL2 and Secure stage-2 support are
implemented.

Signed-off-by: Tao Tang <[email protected]>
---
 hw/arm/smmuv3.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index b5dc67dcb01..3ff2f498a3b 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -597,7 +597,7 @@ static void decode_ste_config(SMMUTransCfg *cfg, uint32_t config)
 
 /* Returns < 0 in case of invalid STE, 0 otherwise */
 static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
-                      STE *ste, SMMUEventInfo *event)
+                      STE *ste, SMMUEventInfo *event, SMMUSecSID sec_sid)
 {
     uint32_t config;
     /* OAS field only presents on NS-IDR5 so we use hardcoded SMMU_SEC_SID_NS */
@@ -651,6 +651,14 @@ static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
         if (ret) {
             goto bad_ste;
         }
+
+        /*
+         * It is ILLEGAL to set STE.Config == 0b11x according to (IHI 0070G.b)
+         * 5.2 STE, Stream Table Entry, Page 218.
+         */
+        if (sec_sid == SMMU_SEC_SID_S) {
+            goto bad_ste;
+        }
     }
 
     /* Multiple context descriptors require SubstreamID support */
@@ -916,7 +924,7 @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
         return ret;
     }
 
-    ret = decode_ste(s, cfg, &ste, event);
+    ret = decode_ste(s, cfg, &ste, event, sec_sid);
     if (ret) {
         return ret;
     }
-- 
2.34.1